Vinícius Ferrão wrote: > > >> On 15 Oct 2019, at 17:49, Rob Crittenden <[email protected] >> <mailto:[email protected]>> wrote: >> >> Vinícius Ferrão wrote: >>> Hi Rob >>> >>>> On 15 Oct 2019, at 10:22, Rob Crittenden <[email protected] >>>> <mailto:[email protected]> >>>> <mailto:[email protected]>> wrote: >>>> >>>> Vinícius Ferrão via FreeIPA-users wrote: >>>>> Hello, >>>>> >>>>> I’m trying to implement SSH Hostbased Authentication between IPA >>>>> joined machines but I’m with difficulties regarding: >>>>> >>>>> * The /etc/ssh/ssh_known_hosts file. >>>>> >>>>> In a FreeIPA environment the known_hosts are stored on IPA, and I’m >>>>> aware of the ProxyCommand /usr/bin/sss_ssh_knownhostsproxy; but how >>>>> can I create this file with the entries from FreeIPA? >>>> >>>> Why do you want to? That is the point of the proxy, so dynamic files >>>> don't need to be maintained. >>> >>> Because it appears to be a requirement. Unfortunately SSH does not look >>> at /var/lib/sss/pubconf/known_hosts: >>> >>> debug1: userauth_hostbased: cuser admin chost >>> hpclab01.cluster.iq.ufrj.br <http://hpclab01.cluster.iq.ufrj.br> >>> <http://hpclab01.cluster.iq.ufrj.br>. pkalg >>> ecdsa-sha2-nistp256 slen 100 [preauth] >>> debug3: mm_key_allowed entering [preauth] >>> debug3: mm_request_send entering: type 22 [preauth] >>> debug3: mm_key_allowed: waiting for MONITOR_ANS_KEYALLOWED [preauth] >>> debug3: mm_request_receive_expect entering: type 23 [preauth] >>> debug3: mm_request_receive entering [preauth] >>> debug3: mm_request_receive entering >>> debug3: monitor_read: checking request 22 >>> debug3: mm_answer_keyallowed entering >>> debug3: mm_answer_keyallowed: key_from_blob: 0x561842345040 >>> debug2: hostbased_key_allowed: chost hpclab01.cluster.iq.ufrj.br >>> <http://hpclab01.cluster.iq.ufrj.br> >>> <http://hpclab01.cluster.iq.ufrj.br>. resolvedname >>> hpclab01.cluster.iq.ufrj.br <http://hpclab01.cluster.iq.ufrj.br> >>> <http://hpclab01.cluster.iq.ufrj.br> ipaddr >>> 172.26.0.1 >>> debug2: stripping trailing dot from chost hpclab01.cluster.iq.ufrj.br >>> <http://hpclab01.cluster.iq.ufrj.br> >>> <http://hpclab01.cluster.iq.ufrj.br>. >>> debug2: auth_rhosts2: clientuser admin hostname >>> hpclab01.cluster.iq.ufrj.br <http://hpclab01.cluster.iq.ufrj.br> >>> <http://hpclab01.cluster.iq.ufrj.br> ipaddr >>> 172.26.0.1 >>> debug1: temporarily_use_uid: 1683000000/1683000000 (e=0/0) >>> debug1: restore_uid: 0/0 >>> debug1: fd 8 clearing O_NONBLOCK >>> debug2: hostbased_key_allowed: access allowed by auth_rhosts2 >>> debug1: temporarily_use_uid: 1683000000/1683000000 (e=0/0) >>> debug1: restore_uid: 0/0 >>> debug1: check_key_in_hostfiles: key for host >>> hpclab01.cluster.iq.ufrj.br <http://hpclab01.cluster.iq.ufrj.br> >>> <http://hpclab01.cluster.iq.ufrj.br> not found >>> debug1: temporarily_use_uid: 1683000000/1683000000 (e=0/0) >>> debug1: restore_uid: 0/0 >>> debug1: check_key_in_hostfiles: key for host >>> hpclab01.cluster.iq.ufrj.br <http://hpclab01.cluster.iq.ufrj.br> >>> <http://hpclab01.cluster.iq.ufrj.br> not found >>> debug3: mm_answer_keyallowed: key 0x561842345040 is not allowed >>> Failed hostbased for admin from 172.26.0.1 port 55634 ssh2: ECDSA >>> SHA256:wJ0OVmkiVnMjuoiRe5sdBVz5sMTTKIbYRWorTk+CnUQ, client user "admin", >>> client host "hpclab01.cluster.iq.ufrj.br >>> <http://hpclab01.cluster.iq.ufrj.br> >>> <http://hpclab01.cluster.iq.ufrj.br>” >> >> It does for me: >> >> debug3: hostkeys_foreach: reading file "/root/.ssh/known_hosts" >> debug3: hostkeys_foreach: reading file "/var/lib/sss/pubconf/known_hosts" >> debug3: record_hostkey: found key type ED25519 in file >> /var/lib/sss/pubconf/known_hosts:2 >> debug3: record_hostkey: found key type RSA in file >> /var/lib/sss/pubconf/known_hosts:4 >> debug3: record_hostkey: found key type ECDSA in file >> /var/lib/sss/pubconf/known_hosts:6 >> >> The client only pushes the SSHFP records on enrollment if IPA is serving >> DNS. > > Rob, I’m not sure if we are talking about the same thing. In fact this > part works for me too:
You're right, I missed the hostbased-part. I don't know that anyone has tried this before. Perhaps someone from the sssd team would know since they manage the proxy. rob _______________________________________________ FreeIPA-users mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/[email protected]
